@rozoai/checkout 0.1.22 → 0.1.24

package/scripts/dist/quote.js

@@ -301,9 +301,15 @@ var MPP_BASE = process.env.ROZO_CHECKOUT_MPP_BASE || "https://apiserver.mpproute
 var CLIENT_LABEL = `rozo-checkout-cli/${PKG_VERSION}`;
 var ATTRIBUTION_CLIENT = `rozo-checkout-skill/${PKG_VERSION}`;
 var INTENTS_BASE = process.env.ROZO_CHECKOUT_INTENTS_BASE || "https://intentapiv4.rozo.ai/functions/v1/payment-api";
-async function quoteInvoice({ url, linkId }) {
+async function quoteInvoice({ url, linkId, beta }) {
   const body = url ? { url } : { payment_id: linkId };
-  return postJson(`${MPP_BASE}/quote-invoice`, body);
+  return postJson(withBeta(`${MPP_BASE}/quote-invoice`, beta), body);
+}
+function withBeta(url, beta) {
+  if (!beta) return url;
+  const u = new URL(url);
+  u.searchParams.set("beta", beta);
+  return u.toString();
 }
 function snapshotFromQuote(quote) {
   const cb = quote?.coinbasePayment || quote?.paymentLink || null;
@@ -333,7 +339,8 @@ var CHAIN_NAMES = {
   42161: "Arbitrum",
   900: "Solana",
   1500: "Stellar",
-  lightning: "Bitcoin Lightning"
+  lightning: "Bitcoin Lightning",
+  9133: "Zcash"
 };
 var SUPPORTED_SOURCES = [
   { chainId: "1", chain: "Ethereum", tokens: ["USDC", "USDT", "ETH"] },
@@ -343,7 +350,9 @@ var SUPPORTED_SOURCES = [
   { chainId: "8453", chain: "Base", tokens: ["USDC", "ETH"] },
   { chainId: "42161", chain: "Arbitrum", tokens: ["USDC", "USDT", "ETH"] },
   { chainId: "1500", chain: "Stellar", tokens: ["USDC"] },
-  { chainId: "lightning", chain: "Bitcoin Lightning", tokens: ["BTC"] }
+  { chainId: "lightning", chain: "Bitcoin Lightning", tokens: ["BTC"] },
+  // ZEC (Beta): shielded orders only, offered per invoice by the router (see lib/zec.mjs).
+  { chainId: "9133", chain: "Zcash", tokens: ["ZEC"] }
 ];
 var NATIVE_COINS = Object.freeze({
   "1:ETH": { chainId: "1", symbol: "ETH", decimals: 18 },
@@ -353,7 +362,7 @@ var NATIVE_COINS = Object.freeze({
   "137:POL": { chainId: "137", symbol: "POL", decimals: 18 },
   "900:SOL": { chainId: "900", symbol: "SOL", decimals: 9 }
 });
-var NATIVE_MAX_USD = 2e3;
+var NATIVE_MAX_USD = 3500;
 var NATIVE_MIN_USD_FALLBACK = Object.freeze({ "1:ETH": 1 });
 function decimalsKey(chainId, tokenSymbol) {
   return `${String(chainId).trim()}:${String(tokenSymbol || "").trim().toUpperCase()}`;
@@ -434,7 +443,9 @@ var MARGINS_MS = {
   42161: 10 * MINUTE,
   900: 5 * MINUTE,
   1500: 10 * MINUTE,
-  lightning: 10 * MINUTE
+  lightning: 10 * MINUTE,
+  // Zcash: 75 s blocks, 1 to 2 confirmations, then the hub advances the merchant.
+  9133: 10 * MINUTE
 };
 var BOLT11_MIN_VALIDITY_MS = 10 * MINUTE;
 var DEFAULT_MARGIN_MS = 10 * MINUTE;
@@ -454,6 +465,69 @@ function parseDeadline(value) {
   return Number.isFinite(t) ? t : null;
 }
 
+// scripts/src/lib/zec.mjs
+var ZEC_CHAIN_ID = "9133";
+var ZEC_SYMBOL = "ZEC";
+var ZEC_SOURCE_META_KEY = "ZEC@9133";
+var ZEC_BETA_PARAM = "zec,zec_shielded";
+var ZEC_SHIELDED_MAX_USD = 1200;
+var ZEC_MIN_USD = 5;
+var ZEC_TWO_CONF_FROM_USD = 110;
+function isZecSource(chainId, tokenSymbol) {
+  return String(chainId ?? "").trim() === ZEC_CHAIN_ID && String(tokenSymbol ?? "").trim().toUpperCase() === ZEC_SYMBOL;
+}
+function zecRequiredConfirmations(usd) {
+  const n = Number(usd);
+  return Number.isFinite(n) && n >= ZEC_TWO_CONF_FROM_USD ? 2 : 1;
+}
+function zecShieldedOfferFor({ supportedSources, sourceMeta, callerPaysUsd }) {
+  const list = supportedSources && typeof supportedSources === "object" ? supportedSources[ZEC_CHAIN_ID] : null;
+  if (!Array.isArray(list) || !list.map((t) => String(t).toUpperCase()).includes(ZEC_SYMBOL)) {
+    return {
+      ok: false,
+      code: "ZEC_NOT_OFFERED",
+      reason: "ZEC is not offered for this invoice. Pay with USDC or USDT instead.",
+      requiredConfirmations: null
+    };
+  }
+  const meta = sourceMeta && typeof sourceMeta === "object" ? sourceMeta[ZEC_SOURCE_META_KEY] : null;
+  const available = meta && typeof meta === "object" && (meta.shieldedAvailable === true || meta.shielded_available === true);
+  if (!available) {
+    return {
+      ok: false,
+      code: "ZEC_SHIELDED_NOT_AVAILABLE",
+      reason: "Paying from a shielded balance is not available for this invoice right now.",
+      requiredConfirmations: null
+    };
+  }
+  const usd = Number(callerPaysUsd);
+  if (!Number.isFinite(usd) || usd <= 0) {
+    return {
+      ok: false,
+      code: "ZEC_AMOUNT_UNKNOWN",
+      reason: "The quote carries no USD amount, so the shielded ZEC limits cannot be checked. Pay with USDC or USDT instead.",
+      requiredConfirmations: null
+    };
+  }
+  if (usd > ZEC_SHIELDED_MAX_USD) {
+    return {
+      ok: false,
+      code: "ZEC_AMOUNT_TOO_HIGH",
+      reason: `Shielded ZEC is limited to $${ZEC_SHIELDED_MAX_USD} per payment during the beta; this invoice is $${usd}. Pay with USDC or USDT instead.`,
+      requiredConfirmations: null
+    };
+  }
+  if (usd < ZEC_MIN_USD) {
+    return {
+      ok: false,
+      code: "ZEC_AMOUNT_TOO_LOW",
+      reason: `ZEC payments need an invoice of at least $${ZEC_MIN_USD}; this one is $${usd}. Pay with another coin.`,
+      requiredConfirmations: null
+    };
+  }
+  return { ok: true, code: null, reason: null, requiredConfirmations: zecRequiredConfirmations(usd) };
+}
+
 // scripts/src/lib/guards.mjs
 function normalizeDecimal(v) {
   if (v === null || v === void 0) return null;
@@ -529,7 +603,7 @@ async function main(argv) {
     chosenSource = { chainId, tokenSymbol };
   }
   const now = Date.now();
-  const quote = await quoteInvoice({ url: String(url) });
+  const quote = await quoteInvoice({ url: String(url), beta: ZEC_BETA_PARAM });
   const snapshot = snapshotFromQuote(quote);
   const payability = derivePayable(snapshot, now);
   const nativeOffered = Object.values(NATIVE_COINS).map((c) => ({
@@ -544,6 +618,20 @@ async function main(argv) {
       callerPaysUsd: snapshot.callerPays ?? snapshot.original
     })
   })).filter((c) => c.offer.ok).map((c) => ({ chainId: c.chainId, tokenSymbol: c.tokenSymbol, chain: c.chain, minUsd: c.offer.minUsd }));
+  const zecOffer = zecShieldedOfferFor({
+    supportedSources: quote?.supportedSources,
+    sourceMeta: quote?.sourceMeta,
+    callerPaysUsd: snapshot.callerPays ?? snapshot.original
+  });
+  const zecShielded = {
+    offered: zecOffer.ok,
+    code: zecOffer.code,
+    reason: zecOffer.reason,
+    requiredConfirmations: zecOffer.requiredConfirmations,
+    maxUsd: ZEC_SHIELDED_MAX_USD,
+    note: "ZEC (Beta) is paid from a shielded wallet, exact amount in one transaction; the CLI shows the address, amount and payment URI and never sends. Underpayments are not refunded automatically."
+  };
+  const zecRequested = chosenSource && isZecSource(chosenSource.chainId, chosenSource.tokenSymbol) ? zecOffer : null;
   const nativeRequested = chosenSource && isNativeSource(chosenSource.chainId, chosenSource.tokenSymbol) ? nativeOfferFor({
     ...chosenSource,
     supportedSources: quote?.supportedSources,
@@ -572,7 +660,8 @@ async function main(argv) {
     // and the native coins it makes payable for this invoice.
     routerSupportedSources: quote?.supportedSources && typeof quote.supportedSources === "object" ? quote.supportedSources : null,
     nativeOffered,
-    nativeNote: "Native coins are exact-out: the coin amount is fixed at order creation and its price is locked only until quoteExpiresAt. Up to $2,000 per invoice; native ETH on Ethereum needs $1.",
+    zecShielded,
+    nativeNote: "Native coins are exact-out: the coin amount is fixed at order creation and its price is locked only until quoteExpiresAt. Up to $3,500 per invoice; native ETH on Ethereum needs $1.",
     quoteReceipt: quote?.quoteReceipt ?? null,
     quoteReceiptTtlSeconds: 60,
     quoteReceiptNote: "Short-lived (~60s). create-order.js takes its own fresh quote; do not carry this over.",
@@ -589,6 +678,13 @@ async function main(argv) {
     payload.error = { code: nativeRequested.code, message: nativeRequested.reason };
     emit(payload, EXIT_ERROR);
   }
+  if (zecRequested && !zecRequested.ok) {
+    payload.success = false;
+    payload.nextStep = null;
+    payload.error = { code: zecRequested.code, message: zecRequested.reason };
+    emit(payload, EXIT_ERROR);
+  }
+  if (zecRequested) payload.nextStep = "create-order.js --url <url> --chain 9133 --token ZEC --shielded";
   if (snapshot.callerPays && snapshot.original && normalizeDecimal(snapshot.callerPays) !== normalizeDecimal(snapshot.original)) {
     payload.warnings = [
       `callerPays (${snapshot.callerPays}) differs from the invoice amount (${snapshot.original}). This flow is supposed to charge the full invoice \u2014 do not proceed until that is explained.`

package/scripts/dist/receipt.js

@@ -360,7 +360,8 @@ var CHAIN_NAMES = {
   42161: "Arbitrum",
   900: "Solana",
   1500: "Stellar",
-  lightning: "Bitcoin Lightning"
+  lightning: "Bitcoin Lightning",
+  9133: "Zcash"
 };
 var NATIVE_COINS = Object.freeze({
   "1:ETH": { chainId: "1", symbol: "ETH", decimals: 18 },
@@ -393,7 +394,9 @@ var DECIMALS = {
   "42161:ETH": 18,
   "56:BNB": 18,
   "137:POL": 18,
-  "900:SOL": 9
+  "900:SOL": 9,
+  // Zcash: zatoshi.
+  "9133:ZEC": 8
 };
 var AmountError = class extends Error {
   constructor(code, message) {
@@ -490,6 +493,32 @@ function isNativeSource(chainId, tokenSymbol) {
   return Object.prototype.hasOwnProperty.call(NATIVE_COINS, decimalsKey(chainId, tokenSymbol));
 }
 
+// scripts/src/lib/zec.mjs
+var ZEC_CHAIN_ID = "9133";
+var ZEC_SYMBOL = "ZEC";
+var ZEC_PAYIN_STATES = /* @__PURE__ */ new Set(["awaiting", "seen", "confirming", "eligible", "expired", "reorged"]);
+function isZecSource(chainId, tokenSymbol) {
+  return String(chainId ?? "").trim() === ZEC_CHAIN_ID && String(tokenSymbol ?? "").trim().toUpperCase() === ZEC_SYMBOL;
+}
+function zecStatusOf(source) {
+  const z = source?.zec;
+  if (!z || typeof z !== "object") return null;
+  const receive = z.receive === "shielded" || z.receive === "transparent" ? z.receive : null;
+  const payinState = ZEC_PAYIN_STATES.has(z.payinState) ? z.payinState : null;
+  const confirmations = Number.isInteger(z.confirmations) && z.confirmations >= 0 ? z.confirmations : null;
+  const requiredConfirmations = z.requiredConfirmations === 1 || z.requiredConfirmations === 2 ? z.requiredConfirmations : null;
+  const quoteExpiresAt = typeof z.quoteExpiresAt === "string" && z.quoteExpiresAt ? z.quoteExpiresAt : null;
+  const receivedZat = typeof z.receivedZat === "string" && /^\d+$/.test(z.receivedZat) ? z.receivedZat : null;
+  return { receive, payinState, confirmations, requiredConfirmations, quoteExpiresAt, receivedZat };
+}
+function zecMoneySeen(zec) {
+  if (!zec) return false;
+  if (zec.payinState === "seen" || zec.payinState === "confirming" || zec.payinState === "eligible") return true;
+  if (zec.receivedZat !== null && zec.receivedZat !== "0") return true;
+  if (zec.payinState === null) return true;
+  return false;
+}
+
 // scripts/src/lib/guards.mjs
 var NATIVE_PROGRESS_STATUSES = /* @__PURE__ */ new Set([
   "payment_payin_completed",
@@ -712,7 +741,9 @@ var MARGINS_MS = {
   42161: 10 * MINUTE,
   900: 5 * MINUTE,
   1500: 10 * MINUTE,
-  lightning: 10 * MINUTE
+  lightning: 10 * MINUTE,
+  // Zcash: 75 s blocks, 1 to 2 confirmations, then the hub advances the merchant.
+  9133: 10 * MINUTE
 };
 var BOLT11_MIN_VALIDITY_MS = 10 * MINUTE;
 var DEFAULT_MARGIN_MS = 10 * MINUTE;
@@ -1202,13 +1233,15 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
   });
   const source = payment?.source || status?.rozoPayment?.source || {};
   const native = isNativeSource(source.chainId, source.tokenSymbol);
+  const isZec = isZecSource(source.chainId, source.tokenSymbol);
+  const zec = isZec ? zecStatusOf(source) : null;
   let localState = null;
   try {
     localState = id && isRozoPaymentId(id) ? readState(id) : null;
   } catch {
     localState = null;
   }
-  const quoteExpiresAt = priceLockFor({
+  const quoteExpiresAt = isZec ? zec?.quoteExpiresAt ?? null : priceLockFor({
     native,
     payment: payment || status?.rozoPayment || null,
     others: [localState?.confirmation?.quoteExpiresAt, localState?.quoteExpiresAt]
@@ -1217,6 +1250,17 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
   let state = verdict.state;
   let terminal = verdict.terminal;
   let detail = verdict.detail;
+  const zecMoney = Boolean(zec && zecMoneySeen(zec));
+  let escalate = verdict.escalate;
+  if (zecMoney && state === "expired_unfunded") {
+    state = "stuck_after_payment";
+    terminal = false;
+    escalate = true;
+    detail = "The order expired but the custody rail reports a ZEC pay-in. Do not pay again; escalate for manual reconciliation.";
+  } else if (zecMoney && state === "awaiting_deposit") {
+    state = "payin_detected";
+    detail = zec.payinState === "seen" || zec.payinState === "confirming" ? `Shielded pay-in ${zec.payinState}: ${zec.confirmations ?? 0} of ${zec.requiredConfirmations ?? "?"} confirmations.` : `The custody rail reports a ZEC pay-in (${zec.payinState ?? "state unreadable"}). Do not pay again.`;
+  }
   if (provider === "bitrefill") {
     let local = null;
     try {
@@ -1246,9 +1290,9 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
     linkId: linkId || status?.pl_id || null,
     state,
     unknown: verdict.unknown,
-    moneyDetected: verdict.moneyDetected,
+    moneyDetected: verdict.moneyDetected || zecMoney,
     terminal,
-    escalate: verdict.escalate,
+    escalate,
     detail,
     backend: {
       paymentStatus: payment?.status ?? status?.rozoPayment?.status ?? null,
@@ -1263,7 +1307,9 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
       txHash: publicHash(source.txHash ?? null),
       confirmedAt: source.confirmedAt ?? null,
       senderAddressMasked: source.senderAddress ? maskAddress(source.senderAddress) : null,
-      chain: source.chainId ? chainName(source.chainId) : null
+      chain: source.chainId ? chainName(source.chainId) : null,
+      // Shielded ZEC only: the custody rail's own view of the pay-in.
+      ...zec ? { zec } : {}
     },
     expiry: (() => {
       if (provider === "bitrefill" && !bitrefillExpiry) {
@@ -1279,7 +1325,7 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
         msRemaining: Number.isFinite(ms) ? ms : null,
         // Native orders: the order stays open after the price lock, but a
         // payment after it is valued at the arrival price. Pay before this.
-        ...native ? {
+        ...native || isZec ? {
           quoteExpiresAt: quoteExpiresAt ?? null,
           priceLockExpiresIn: Number.isFinite(lockMs) ? formatRemaining(lockMs) : null
         } : {}
@@ -1290,7 +1336,8 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
       confirmedAt: payment?.destination?.confirmedAt ?? status?.rozoPayment?.destination?.confirmedAt ?? null
     },
     localSend: localSendFor(id),
-    sendWindow: state === "awaiting_deposit" ? sendWindowFor({ provider, chainId: source.chainId, payment, status, bitrefillExpiry, quoteExpiresAt }) : null,
+    // Never a send window once the custody rail has seen a ZEC pay-in.
+    sendWindow: state === "awaiting_deposit" && !zecMoney ? sendWindowFor({ provider, chainId: source.chainId, payment, status, bitrefillExpiry, quoteExpiresAt }) : null,
     errors: [statusError, paymentError].filter(Boolean)
   };
 }

package/scripts/dist/resume.js

@@ -382,7 +382,8 @@ var CHAIN_NAMES = {
   42161: "Arbitrum",
   900: "Solana",
   1500: "Stellar",
-  lightning: "Bitcoin Lightning"
+  lightning: "Bitcoin Lightning",
+  9133: "Zcash"
 };
 var CHAIN_FAMILY = {
   1: "evm",
@@ -392,7 +393,9 @@ var CHAIN_FAMILY = {
   42161: "evm",
   900: "solana",
   1500: "stellar",
-  lightning: "lightning"
+  lightning: "lightning",
+  // Zcash: the CLI creates shielded orders only (pool Unified Address); it never signs.
+  9133: "zcash"
 };
 var NATIVE_COINS = Object.freeze({
   "1:ETH": { chainId: "1", symbol: "ETH", decimals: 18 },
@@ -425,7 +428,9 @@ var DECIMALS = {
   "42161:ETH": 18,
   "56:BNB": 18,
   "137:POL": 18,
-  "900:SOL": 9
+  "900:SOL": 9,
+  // Zcash: zatoshi.
+  "9133:ZEC": 8
 };
 var AmountError = class extends Error {
   constructor(code, message) {
@@ -526,6 +531,96 @@ function isNativeSource(chainId, tokenSymbol) {
   return Object.prototype.hasOwnProperty.call(NATIVE_COINS, decimalsKey(chainId, tokenSymbol));
 }
 
+// scripts/src/lib/zec.mjs
+var ZEC_CHAIN_ID = "9133";
+var ZEC_SYMBOL = "ZEC";
+var ZEC_PAYIN_STATES = /* @__PURE__ */ new Set(["awaiting", "seen", "confirming", "eligible", "expired", "reorged"]);
+var UA_RE = /^u1[02-9ac-hj-np-z]{100,400}$/;
+function isZecSource(chainId, tokenSymbol) {
+  return String(chainId ?? "").trim() === ZEC_CHAIN_ID && String(tokenSymbol ?? "").trim().toUpperCase() === ZEC_SYMBOL;
+}
+function isUnifiedAddress(value) {
+  return typeof value === "string" && UA_RE.test(value.trim());
+}
+function zecStatusOf(source) {
+  const z = source?.zec;
+  if (!z || typeof z !== "object") return null;
+  const receive = z.receive === "shielded" || z.receive === "transparent" ? z.receive : null;
+  const payinState = ZEC_PAYIN_STATES.has(z.payinState) ? z.payinState : null;
+  const confirmations = Number.isInteger(z.confirmations) && z.confirmations >= 0 ? z.confirmations : null;
+  const requiredConfirmations = z.requiredConfirmations === 1 || z.requiredConfirmations === 2 ? z.requiredConfirmations : null;
+  const quoteExpiresAt = typeof z.quoteExpiresAt === "string" && z.quoteExpiresAt ? z.quoteExpiresAt : null;
+  const receivedZat = typeof z.receivedZat === "string" && /^\d+$/.test(z.receivedZat) ? z.receivedZat : null;
+  return { receive, payinState, confirmations, requiredConfirmations, quoteExpiresAt, receivedZat };
+}
+function zecMoneySeen(zec) {
+  if (!zec) return false;
+  if (zec.payinState === "seen" || zec.payinState === "confirming" || zec.payinState === "eligible") return true;
+  if (zec.receivedZat !== null && zec.receivedZat !== "0") return true;
+  if (zec.payinState === null) return true;
+  return false;
+}
+function parsePaymentUri(uri) {
+  if (typeof uri !== "string") return null;
+  const m = /^zcash:([0-9a-z]+)\?([^#]*)$/i.exec(uri.trim());
+  if (!m) return null;
+  const address = m[1];
+  const out = { address, amount: null, memo: null };
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of m[2].split("&")) {
+    if (!part) return null;
+    const eq = part.indexOf("=");
+    if (eq <= 0) return null;
+    const key = part.slice(0, eq);
+    const value = part.slice(eq + 1);
+    if (seen.has(key)) return null;
+    seen.add(key);
+    if (key === "amount") {
+      if (!/^\d+(\.\d{1,8})?$/.test(value)) return null;
+      out.amount = value;
+    } else if (key === "memo") {
+      if (!/^[A-Za-z0-9_-]{1,684}$/.test(value)) return null;
+      out.memo = value;
+    } else {
+      return null;
+    }
+  }
+  if (out.amount === null) return null;
+  return out;
+}
+function sameDecimal(a, b) {
+  const norm = (v) => {
+    const s = String(v ?? "").trim();
+    if (!/^\d+(\.\d+)?$/.test(s)) return null;
+    const [w, f = ""] = s.split(".");
+    const frac = f.replace(/0+$/, "");
+    return `${w.replace(/^0+(?=\d)/, "")}${frac ? `.${frac}` : ""}`;
+  };
+  const na = norm(a);
+  return na !== null && na === norm(b);
+}
+function validateShieldedDeposit(source) {
+  const address = typeof source?.receiverAddress === "string" ? source.receiverAddress.trim() : "";
+  if (!isUnifiedAddress(address)) {
+    return { ok: false, code: "ZEC_ADDRESS_INVALID", reason: "The order did not return a mainnet Unified Address (u1...). Refusing to show it as payable." };
+  }
+  const uri = typeof source?.paymentUri === "string" ? source.paymentUri.trim() : "";
+  if (!uri) {
+    return { ok: false, code: "ZEC_PAYMENT_URI_MISSING", reason: "The order carries no payment URI yet. Nothing is payable until it appears." };
+  }
+  const parsed = parsePaymentUri(uri);
+  if (!parsed) {
+    return { ok: false, code: "ZEC_PAYMENT_URI_INVALID", reason: "The payment URI is not a single-payment ZIP-321 URI. Refusing to show it." };
+  }
+  if (parsed.address !== address) {
+    return { ok: false, code: "ZEC_PAYMENT_URI_MISMATCH", reason: "The payment URI names a different address than the order. Refusing to show it." };
+  }
+  if (!sameDecimal(parsed.amount, source?.amount)) {
+    return { ok: false, code: "ZEC_PAYMENT_URI_MISMATCH", reason: "The payment URI amount differs from the order amount. Refusing to show it." };
+  }
+  return { ok: true, code: null, reason: null, address, paymentUri: uri, memo: parsed.memo };
+}
+
 // scripts/src/lib/guards.mjs
 var UNPAID_STATUS = "payment_unpaid";
 var NATIVE_PROGRESS_STATUSES = /* @__PURE__ */ new Set([
@@ -586,6 +681,11 @@ function validateDepositInstructions(source) {
       reason: "The live payments response returned no deposit address."
     };
   }
+  if (family === "zcash" && zecStatusOf(source)?.receive === "shielded") {
+    const zec = validateShieldedDeposit(source);
+    if (!zec.ok) return { ok: false, code: zec.code, reason: zec.reason };
+    return { ok: true, code: null, reason: null, family, amountAtomic, payTo: zec.address, memo: null, paymentUri: zec.paymentUri };
+  }
   if (family === "stellar" && !memo) {
     return {
       ok: false,
@@ -618,13 +718,14 @@ function reuseGuard({ payment, requested, reused = false }) {
   const hasTx = source.txHash !== null && source.txHash !== void 0 && source.txHash !== "";
   const signal = receiptSignal(source);
   const hasConfirm = source.confirmedAt !== null && source.confirmedAt !== void 0 && source.confirmedAt !== "";
-  if (hasTx || signal.money || hasConfirm) {
+  const zecSeen = isZecSource(source.chainId, source.tokenSymbol) && zecMoneySeen(zecStatusOf(source));
+  if (hasTx || signal.money || hasConfirm || zecSeen) {
     return {
       ok: false,
       code: "ORDER_ALREADY_FUNDED",
-      reason: signal.unparsable ? "This order reports an amountReceived that cannot be read. It is treated as funded until a human confirms otherwise \u2014 do NOT pay again." : "This Coinbase link already has a funded Rozo order (it may have been paid elsewhere). Do NOT pay again \u2014 escalate for manual reconciliation.",
+      reason: signal.unparsable ? "This order reports an amountReceived that cannot be read. It is treated as funded until a human confirms otherwise \u2014 do NOT pay again." : zecSeen && !hasTx && !signal.money && !hasConfirm ? "A shielded ZEC payment to this order has already been seen on the network. Do NOT pay again; watch it with status instead." : "This Coinbase link already has a funded Rozo order (it may have been paid elsewhere). Do NOT pay again \u2014 escalate for manual reconciliation.",
       moneyDetected: true,
-      evidence: { ...evidence, receipt: signal.receipt, receiptUnparsable: signal.unparsable }
+      evidence: { ...evidence, receipt: signal.receipt, receiptUnparsable: signal.unparsable, ...zecSeen ? { zec: zecStatusOf(source) } : {} }
     };
   }
   if (payment?.status !== UNPAID_STATUS) {
@@ -652,6 +753,28 @@ function reuseGuard({ payment, requested, reused = false }) {
       evidence
     };
   }
+  if (isZecSource(gotChain, gotToken)) {
+    const zec = zecStatusOf(source);
+    const wantReceive = requested?.shielded === true ? "shielded" : "transparent";
+    if (!zec || zec.receive !== wantReceive) {
+      return {
+        ok: false,
+        code: "ZEC_RECEIVE_MODE_MISMATCH",
+        reason: `This link already has a ZEC order that is paid ${zec?.receive ?? "in an unknown way"}, but you asked for ${wantReceive}. Nothing new was created. Pay that order the way it was made, or wait for it to expire unfunded.`,
+        moneyDetected: false,
+        evidence: { ...evidence, zec }
+      };
+    }
+    if (zec.payinState === "expired" || zec.payinState === "reorged") {
+      return {
+        ok: false,
+        code: "ZEC_QUOTE_EXPIRED",
+        reason: `The ZEC price lock on this order has ${zec.payinState === "reorged" ? "been disturbed by a reorg" : "expired"} with nothing received. Do not pay it; re-run pay to get a fresh order.`,
+        moneyDetected: false,
+        evidence: { ...evidence, zec }
+      };
+    }
+  }
   const deposit = validateDepositInstructions(source);
   if (!deposit.ok) {
     return {
@@ -989,7 +1112,9 @@ var MARGINS_MS = {
   42161: 10 * MINUTE,
   900: 5 * MINUTE,
   1500: 10 * MINUTE,
-  lightning: 10 * MINUTE
+  lightning: 10 * MINUTE,
+  // Zcash: 75 s blocks, 1 to 2 confirmations, then the hub advances the merchant.
+  9133: 10 * MINUTE
 };
 var BOLT11_MIN_VALIDITY_MS = 10 * MINUTE;
 var DEFAULT_MARGIN_MS = 10 * MINUTE;
@@ -1276,13 +1401,15 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
   });
   const source = payment?.source || status?.rozoPayment?.source || {};
   const native = isNativeSource(source.chainId, source.tokenSymbol);
+  const isZec = isZecSource(source.chainId, source.tokenSymbol);
+  const zec = isZec ? zecStatusOf(source) : null;
   let localState = null;
   try {
     localState = id && isRozoPaymentId(id) ? readState(id) : null;
   } catch {
     localState = null;
   }
-  const quoteExpiresAt = priceLockFor({
+  const quoteExpiresAt = isZec ? zec?.quoteExpiresAt ?? null : priceLockFor({
     native,
     payment: payment || status?.rozoPayment || null,
     others: [localState?.confirmation?.quoteExpiresAt, localState?.quoteExpiresAt]
@@ -1291,6 +1418,17 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
   let state = verdict.state;
   let terminal = verdict.terminal;
   let detail = verdict.detail;
+  const zecMoney = Boolean(zec && zecMoneySeen(zec));
+  let escalate = verdict.escalate;
+  if (zecMoney && state === "expired_unfunded") {
+    state = "stuck_after_payment";
+    terminal = false;
+    escalate = true;
+    detail = "The order expired but the custody rail reports a ZEC pay-in. Do not pay again; escalate for manual reconciliation.";
+  } else if (zecMoney && state === "awaiting_deposit") {
+    state = "payin_detected";
+    detail = zec.payinState === "seen" || zec.payinState === "confirming" ? `Shielded pay-in ${zec.payinState}: ${zec.confirmations ?? 0} of ${zec.requiredConfirmations ?? "?"} confirmations.` : `The custody rail reports a ZEC pay-in (${zec.payinState ?? "state unreadable"}). Do not pay again.`;
+  }
   if (provider === "bitrefill") {
     let local = null;
     try {
@@ -1320,9 +1458,9 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
     linkId: linkId || status?.pl_id || null,
     state,
     unknown: verdict.unknown,
-    moneyDetected: verdict.moneyDetected,
+    moneyDetected: verdict.moneyDetected || zecMoney,
     terminal,
-    escalate: verdict.escalate,
+    escalate,
     detail,
     backend: {
       paymentStatus: payment?.status ?? status?.rozoPayment?.status ?? null,
@@ -1337,7 +1475,9 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
       txHash: publicHash(source.txHash ?? null),
       confirmedAt: source.confirmedAt ?? null,
       senderAddressMasked: source.senderAddress ? maskAddress(source.senderAddress) : null,
-      chain: source.chainId ? chainName(source.chainId) : null
+      chain: source.chainId ? chainName(source.chainId) : null,
+      // Shielded ZEC only: the custody rail's own view of the pay-in.
+      ...zec ? { zec } : {}
     },
     expiry: (() => {
       if (provider === "bitrefill" && !bitrefillExpiry) {
@@ -1353,7 +1493,7 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
         msRemaining: Number.isFinite(ms) ? ms : null,
         // Native orders: the order stays open after the price lock, but a
         // payment after it is valued at the arrival price. Pay before this.
-        ...native ? {
+        ...native || isZec ? {
           quoteExpiresAt: quoteExpiresAt ?? null,
           priceLockExpiresIn: Number.isFinite(lockMs) ? formatRemaining(lockMs) : null
         } : {}
@@ -1364,7 +1504,8 @@ async function snapshot({ rozoPaymentId, linkId, provider: explicitProvider }) {
       confirmedAt: payment?.destination?.confirmedAt ?? status?.rozoPayment?.destination?.confirmedAt ?? null
     },
     localSend: localSendFor(id),
-    sendWindow: state === "awaiting_deposit" ? sendWindowFor({ provider, chainId: source.chainId, payment, status, bitrefillExpiry, quoteExpiresAt }) : null,
+    // Never a send window once the custody rail has seen a ZEC pay-in.
+    sendWindow: state === "awaiting_deposit" && !zecMoney ? sendWindowFor({ provider, chainId: source.chainId, payment, status, bitrefillExpiry, quoteExpiresAt }) : null,
     errors: [statusError, paymentError].filter(Boolean)
   };
 }
@@ -1506,7 +1647,12 @@ async function main(argv) {
   }
   const payment = await getPayment(id);
   const source = payment?.source || {};
-  const guard = reuseGuard({ payment, requested: { chainId: source.chainId, tokenSymbol: source.tokenSymbol }, reused: true });
+  const resumedShielded = isZecSource(source.chainId, source.tokenSymbol) && zecStatusOf(source)?.receive === "shielded";
+  const guard = reuseGuard({
+    payment,
+    requested: { chainId: source.chainId, tokenSymbol: source.tokenSymbol, ...resumedShielded ? { shielded: true } : {} },
+    reused: true
+  });
   if (!guard.ok) {
     emit(
       {
@@ -1524,13 +1670,16 @@ async function main(argv) {
     );
   }
   const native = isNativeSource(source.chainId, source.tokenSymbol);
-  const quoteExpiresAt = priceLockFor({ native, payment, others: [snap.expiry?.quoteExpiresAt] });
+  const isZec = isZecSource(source.chainId, source.tokenSymbol);
+  const zecStatus = isZec ? zecStatusOf(source) : null;
+  const zec = Boolean(zecStatus && zecStatus.receive === "shielded");
+  const quoteExpiresAt = isZec ? zecStatus?.quoteExpiresAt ?? null : priceLockFor({ native, payment, others: [snap.expiry?.quoteExpiresAt] });
   const finalWindow = checkExpiry({
     now: Date.now(),
     chainId: source.chainId,
     intentExpiresAt: payment?.expiresAt ?? snap.sendWindow?.deadlineMs,
     coinbaseExpiry: snap.sendWindow?.deadlineMs,
-    ...native ? { quoteExpiresAt } : {}
+    ...native || isZec ? { quoteExpiresAt } : {}
   });
   if (!finalWindow.ok) {
     emit(
@@ -1605,8 +1754,14 @@ async function main(argv) {
       expiresAt,
       expiresIn,
       native,
-      exactOut: native || lightning,
-      quoteExpiresAt: native ? quoteExpiresAt : null
+      exactOut: native || lightning || zec,
+      quoteExpiresAt: native || zec ? quoteExpiresAt : null,
+      ...zec ? {
+        shielded: true,
+        paymentUri: guard.deposit.paymentUri,
+        requiredConfirmations: zecStatus.requiredConfirmations,
+        payinState: zecStatus.payinState
+      } : {}
     } : null,
     depositWithheld: !confirmed,
     display: {
@@ -1619,12 +1774,13 @@ async function main(argv) {
       hasMemo: Boolean(source.receiverMemo),
       memoType: source.receiverMemo ? STELLAR_MEMO_TYPE : null,
       native,
-      priceLockedUntil: native ? quoteExpiresAt : null
+      priceLockedUntil: native || zec ? quoteExpiresAt : null,
+      ...zec ? { shielded: true } : {}
     },
     expiry: {
       expiresAt,
       expiresIn,
-      ...native ? { quoteExpiresAt } : {},
+      ...native || zec ? { quoteExpiresAt } : {},
       minutesOfSlack: snap.sendWindow?.minutesOfSlack ?? null
     },
     note: confirmed ? "Send exactly once, exactly this amount, on this chain. Then: rozo-checkout status <id> --watch" : "Deposit address withheld. Confirm the chain, token and amount with the payer, then re-run with --confirm, or open paymentLink."